@nervekit/tools 0.1.0

package/dist/execution/web-search.d.ts

@@ -0,0 +1,3 @@
+import type { ToolExecutionContext, ToolExecutionResult } from "../types.js";
+export declare function executeWebSearch(args: Record<string, unknown>, context: ToolExecutionContext): Promise<ToolExecutionResult>;
+//# sourceMappingURL=web-search.d.ts.map

package/dist/execution/web-search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-search.d.ts","sourceRoot":"","sources":["../../src/execution/web-search.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAmC7E,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAoD9B"}

package/dist/execution/web-search.js

@@ -0,0 +1,59 @@
+import { numberArg } from "./common.js";
+function stringArg(value, name) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new Error(`${name} must be a non-empty string.`);
+    }
+    return value;
+}
+function maxResultsArg(value) {
+    const parsed = numberArg(value, 5);
+    return Math.min(20, Math.max(1, parsed));
+}
+function timeoutSignal(signal, milliseconds) {
+    const timeout = AbortSignal.timeout(milliseconds);
+    return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+export async function executeWebSearch(args, context) {
+    const query = stringArg(args.query, "query");
+    const maxResults = maxResultsArg(args.max_results);
+    const apiKey = (await context.getApiKey?.("tavily")) ?? process.env.TAVILY_API_KEY;
+    if (!apiKey) {
+        throw new Error("Tavily API key is not configured. Configure provider 'tavily' in Nerve or set TAVILY_API_KEY.");
+    }
+    const response = await fetch("https://api.tavily.com/search", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            api_key: apiKey,
+            query,
+            max_results: maxResults,
+            include_answer: true,
+        }),
+        signal: timeoutSignal(context.signal, 60_000),
+    });
+    if (!response.ok) {
+        throw new Error(`Tavily API error: ${response.status} ${await response.text()}`);
+    }
+    const data = (await response.json());
+    const results = Array.isArray(data.results) ? data.results : [];
+    const lines = [];
+    if (data.answer)
+        lines.push(`**Answer:** ${data.answer}`, "");
+    for (const result of results) {
+        lines.push(`### ${result.title}`, result.url, "", result.content, "");
+    }
+    const content = lines.join("\n").trimEnd();
+    return {
+        content,
+        contentBlocks: [{ type: "text", text: content }],
+        details: {
+            query,
+            answer: data.answer,
+            results: results.map((result) => ({
+                title: result.title,
+                url: result.url,
+            })),
+        },
+    };
+}
+//# sourceMappingURL=web-search.js.map

package/dist/execution/web-search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-search.js","sourceRoot":"","sources":["../../src/execution/web-search.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAcxC,SAAS,SAAS,CAAC,KAAc,EAAE,IAAY;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CACpB,MAA+B,EAC/B,YAAoB;IAEpB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAA6B,EAC7B,OAA6B;IAE7B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,MAAM,GACV,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAEtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,+BAA+B,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,MAAM;YACf,KAAK;YACL,WAAW,EAAE,UAAU;YACvB,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;KAC9C,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,CAAC,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;IACvD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IAE3C,OAAO;QACL,OAAO;QACP,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAChD,OAAO,EAAE;YACP,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC,CAAC;SACJ;KACF,CAAC;AACJ,CAAC"}

package/dist/execution/write.d.ts

@@ -0,0 +1,3 @@
+import type { ToolExecutionContext, ToolExecutionResult } from "../types.js";
+export declare function executeWrite(args: Record<string, unknown>, context: ToolExecutionContext): Promise<ToolExecutionResult>;
+//# sourceMappingURL=write.d.ts.map

package/dist/execution/write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../src/execution/write.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAK7E,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAc9B"}

package/dist/execution/write.js

@@ -0,0 +1,21 @@
+import { mkdir } from "node:fs/promises";
+import { dirname } from "node:path";
+import { writeTextFileAtomically } from "./atomic-write.js";
+import { withFileMutationQueue } from "./file-mutation-queue.js";
+import { resolveToolPath } from "./path.js";
+export async function executeWrite(args, context) {
+    const path = resolveToolPath(context.cwd, args.path);
+    if (typeof args.content !== "string")
+        throw new Error("Tool argument 'content' must be a string.");
+    return withFileMutationQueue(path, async () => {
+        await mkdir(dirname(path), { recursive: true });
+        await writeTextFileAtomically(path, args.content);
+        const content = `Wrote ${Buffer.byteLength(args.content, "utf8")} bytes.`;
+        return {
+            path,
+            content,
+            contentBlocks: [{ type: "text", text: content }],
+        };
+    });
+}
+//# sourceMappingURL=write.js.map

package/dist/execution/write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.js","sourceRoot":"","sources":["../../src/execution/write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAA6B,EAC7B,OAA6B;IAE7B,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAClC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,OAAO,qBAAqB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAiB,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,SAAS,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAiB,EAAE,MAAM,CAAC,SAAS,CAAC;QACpF,OAAO;YACL,IAAI;YACJ,OAAO;YACP,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+import type { ToolDescriptor, ToolName, ToolRisk } from "@nervekit/shared";
+export * from "./catalog/index.js";
+export { appendBoundedTextNotice, type BoundedTextResult, boundContentBlocks, boundLiveOutputChunk, boundText, buildProcessResult, buildProcessTextResult, executeEdit, executeTool, FILE_OUTPUT_MAX_LINE_CHARS, LIVE_OUTPUT_MAX_BYTES, LIVE_OUTPUT_MAX_LINE_CHARS, LIVE_OUTPUT_MAX_LINES, MODEL_TEXT_MAX_BYTES, MODEL_TEXT_MAX_LINE_CHARS, MODEL_TEXT_MAX_LINES, normalizeEditArgs, PROCESS_INLINE_MAX_LINE_CHARS, type PythonRuntime, type PythonRuntimeStatus, resolvePythonRuntime, resolveToolPath, type TextBoundaryDetails, type TextBudget, ToolExecutionError, textBoundaryDetails, } from "./execution/index.js";
+export { hasDangerousCommandPattern, hasShellControlOperator, isAllowedPlanModeBashCommand, isKnownReadOnlyCommand, isLikelyLongRunningCommand, } from "./safety/command-policy.js";
+export * from "./types.js";
+export declare const coreToolDescriptors: ToolDescriptor[];
+export declare const allToolDescriptors: ToolDescriptor[];
+export declare function toolRiskForName(name: ToolName): ToolRisk;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAO3E,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,WAAW,EACX,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,oBAAoB,EACpB,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,cAAc,YAAY,CAAC;AAE3B,eAAO,MAAM,mBAAmB,EAAE,cAAc,EACV,CAAC;AAEvC,eAAO,MAAM,kBAAkB,EAAE,cAAc,EACV,CAAC;AAEtC,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAExD"}

package/dist/index.js

@@ -0,0 +1,11 @@
+import { allToolDescriptorsFromDefinitions, coreToolDescriptorsFromDefinitions, coreToolRiskForName, } from "./catalog/index.js";
+export * from "./catalog/index.js";
+export { appendBoundedTextNotice, boundContentBlocks, boundLiveOutputChunk, boundText, buildProcessResult, buildProcessTextResult, executeEdit, executeTool, FILE_OUTPUT_MAX_LINE_CHARS, LIVE_OUTPUT_MAX_BYTES, LIVE_OUTPUT_MAX_LINE_CHARS, LIVE_OUTPUT_MAX_LINES, MODEL_TEXT_MAX_BYTES, MODEL_TEXT_MAX_LINE_CHARS, MODEL_TEXT_MAX_LINES, normalizeEditArgs, PROCESS_INLINE_MAX_LINE_CHARS, resolvePythonRuntime, resolveToolPath, ToolExecutionError, textBoundaryDetails, } from "./execution/index.js";
+export { hasDangerousCommandPattern, hasShellControlOperator, isAllowedPlanModeBashCommand, isKnownReadOnlyCommand, isLikelyLongRunningCommand, } from "./safety/command-policy.js";
+export * from "./types.js";
+export const coreToolDescriptors = coreToolDescriptorsFromDefinitions();
+export const allToolDescriptors = allToolDescriptorsFromDefinitions();
+export function toolRiskForName(name) {
+    return coreToolRiskForName(name);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iCAAiC,EACjC,kCAAkC,EAClC,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,uBAAuB,EAEvB,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,WAAW,EACX,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAG7B,oBAAoB,EACpB,eAAe,EAGf,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,cAAc,YAAY,CAAC;AAE3B,MAAM,CAAC,MAAM,mBAAmB,GAC9B,kCAAkC,EAAE,CAAC;AAEvC,MAAM,CAAC,MAAM,kBAAkB,GAC7B,iCAAiC,EAAE,CAAC;AAEtC,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/safety/command-policy-git.d.ts

@@ -0,0 +1,2 @@
+export declare function isBlockedGitInvocation(tokens: string[]): boolean;
+//# sourceMappingURL=command-policy-git.d.ts.map

package/dist/safety/command-policy-git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-policy-git.d.ts","sourceRoot":"","sources":["../../src/safety/command-policy-git.ts"],"names":[],"mappings":"AAgEA,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CA8ChE"}

package/dist/safety/command-policy-git.js

@@ -0,0 +1,88 @@
+import { hasAnyToken, normalizeCommandName, } from "./command-policy-wrappers.js";
+function getGitSubcommandIndex(tokens) {
+    for (let i = 1; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (token === "-C" ||
+            token === "-c" ||
+            token === "--git-dir" ||
+            token === "--namespace" ||
+            token === "--work-tree") {
+            i++;
+            continue;
+        }
+        if (token === "--bare" ||
+            token === "--no-pager" ||
+            token === "--paginate" ||
+            token.startsWith("--git-dir=") ||
+            token.startsWith("--namespace=") ||
+            token.startsWith("--work-tree=")) {
+            continue;
+        }
+        if (token.startsWith("-"))
+            continue;
+        return i;
+    }
+    return undefined;
+}
+const BLOCKED_GIT_SUBCOMMANDS = new Set([
+    "add",
+    "am",
+    "apply",
+    "bisect",
+    "checkout",
+    "cherry-pick",
+    "clean",
+    "clone",
+    "commit",
+    "fetch",
+    "gc",
+    "init",
+    "merge",
+    "mv",
+    "pull",
+    "push",
+    "rebase",
+    "reflog",
+    "reset",
+    "restore",
+    "revert",
+    "rm",
+    "stash",
+    "submodule",
+    "switch",
+    "tag",
+    "worktree",
+]);
+export function isBlockedGitInvocation(tokens) {
+    const rootCommand = normalizeCommandName(tokens[0] ?? "");
+    if (rootCommand !== "git")
+        return false;
+    const subcommandIndex = getGitSubcommandIndex(tokens);
+    if (subcommandIndex === undefined)
+        return false;
+    const subcommand = tokens[subcommandIndex];
+    const args = tokens.slice(subcommandIndex + 1);
+    if (subcommand === "branch") {
+        return hasAnyToken(args, new Set(["-d", "-D", "-m", "-M", "--delete", "--move"]));
+    }
+    if (subcommand === "config") {
+        return !args.some((arg) => arg === "--get" ||
+            arg === "--get-all" ||
+            arg === "--get-regexp" ||
+            arg === "--list" ||
+            arg === "--name-only" ||
+            arg === "--show-origin" ||
+            arg === "-l");
+    }
+    if (subcommand === "diff") {
+        return args.some((arg) => arg === "--output" || arg.startsWith("--output="));
+    }
+    if (subcommand === "remote") {
+        const remoteAction = args.find((arg) => !arg.startsWith("-"));
+        return !(remoteAction === undefined ||
+            remoteAction === "get-url" ||
+            remoteAction === "show");
+    }
+    return BLOCKED_GIT_SUBCOMMANDS.has(subcommand);
+}
+//# sourceMappingURL=command-policy-git.js.map

package/dist/safety/command-policy-git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-policy-git.js","sourceRoot":"","sources":["../../src/safety/command-policy-git.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AAEtC,SAAS,qBAAqB,CAAC,MAAgB;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IACE,KAAK,KAAK,IAAI;YACd,KAAK,KAAK,IAAI;YACd,KAAK,KAAK,WAAW;YACrB,KAAK,KAAK,aAAa;YACvB,KAAK,KAAK,aAAa,EACvB,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IACE,KAAK,KAAK,QAAQ;YAClB,KAAK,KAAK,YAAY;YACtB,KAAK,KAAK,YAAY;YACtB,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;YAC9B,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;YAChC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,EAChC,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,KAAK;IACL,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,UAAU;IACV,aAAa;IACb,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,IAAI;IACJ,MAAM;IACN,OAAO;IACP,IAAI;IACJ,MAAM;IACN,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,IAAI;IACJ,OAAO;IACP,WAAW;IACX,QAAQ;IACR,KAAK;IACL,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CAAC,MAAgB;IACrD,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,WAAW,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAExC,MAAM,eAAe,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC;IAE/C,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,WAAW,CAChB,IAAI,EACJ,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CACxD,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,KAAK,OAAO;YACf,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,cAAc;YACtB,GAAG,KAAK,QAAQ;YAChB,GAAG,KAAK,aAAa;YACrB,GAAG,KAAK,eAAe;YACvB,GAAG,KAAK,IAAI,CACf,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,CACN,YAAY,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS;YAC1B,YAAY,KAAK,MAAM,CACxB,CAAC;IACJ,CAAC;IAED,OAAO,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC"}

package/dist/safety/command-policy-options.d.ts

@@ -0,0 +1,6 @@
+type SegmentBlocker = (tokens: string[]) => boolean;
+export declare function hasGenericWriteOrLongRunningFlag(tokens: string[]): boolean;
+export declare function isBlockedLongRunningInvocation(tokens: string[]): boolean;
+export declare function isBlockedByCommandOptions(tokens: string[], isBlockedCommandSegment: SegmentBlocker): boolean;
+export {};
+//# sourceMappingURL=command-policy-options.d.ts.map

package/dist/safety/command-policy-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-policy-options.d.ts","sourceRoot":"","sources":["../../src/safety/command-policy-options.ts"],"names":[],"mappings":"AAKA,KAAK,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;AAsBpD,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAS1E;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAuBxE;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EAAE,EAChB,uBAAuB,EAAE,cAAc,GACtC,OAAO,CA6FT"}

package/dist/safety/command-policy-options.js

@@ -0,0 +1,112 @@
+import { hasAnyToken, normalizeCommandName, } from "./command-policy-wrappers.js";
+const INTERPRETER_EVAL_COMMANDS = new Set([
+    "deno",
+    "node",
+    "perl",
+    "php",
+    "python",
+    "python3",
+    "ruby",
+]);
+const GENERIC_WRITE_OR_LONG_RUNNING_FLAGS = new Set([
+    "--fix",
+    "--update-snapshot",
+    "--updateSnapshot",
+    "--watch",
+    "--watch-all",
+    "--watchAll",
+    "--write",
+]);
+export function hasGenericWriteOrLongRunningFlag(tokens) {
+    return tokens.some((token) => {
+        if (GENERIC_WRITE_OR_LONG_RUNNING_FLAGS.has(token))
+            return true;
+        return (token.startsWith("--fix=") ||
+            token.startsWith("--watch=") ||
+            token.startsWith("--write="));
+    });
+}
+export function isBlockedLongRunningInvocation(tokens) {
+    const rootCommand = normalizeCommandName(tokens[0] ?? "");
+    if (["less", "more", "sleep", "top", "htop", "watch", "yes"].includes(rootCommand)) {
+        return true;
+    }
+    if (rootCommand === "tail") {
+        return tokens.some((token) => token === "-f" || token === "--follow");
+    }
+    if (rootCommand === "ping") {
+        return !tokens.some((token) => token === "-c" || token === "--count" || token.startsWith("-c"));
+    }
+    return false;
+}
+export function isBlockedByCommandOptions(tokens, isBlockedCommandSegment) {
+    const rootCommand = normalizeCommandName(tokens[0] ?? "");
+    if (hasGenericWriteOrLongRunningFlag(tokens))
+        return true;
+    if (rootCommand === "find" || rootCommand === "fd") {
+        return hasAnyToken(tokens, new Set([
+            "-X",
+            "-delete",
+            "-exec",
+            "-execdir",
+            "-ok",
+            "-okdir",
+            "-x",
+            "--exec",
+            "--exec-batch",
+        ]));
+    }
+    if ((rootCommand === "sed" || rootCommand === "perl") &&
+        tokens.some((token) => token === "-i" || token.startsWith("-i."))) {
+        return true;
+    }
+    if (rootCommand === "curl" || rootCommand === "wget") {
+        for (let i = 1; i < tokens.length; i++) {
+            const token = tokens[i];
+            if (token === "-O" ||
+                token === "-o" ||
+                token === "--output" ||
+                token === "--remote-name" ||
+                token.startsWith("-O") ||
+                token.startsWith("-o") ||
+                token.startsWith("--output=")) {
+                return true;
+            }
+            const requestMethod = token === "-X" || token === "--request"
+                ? tokens[i + 1]
+                : token.startsWith("-X")
+                    ? token.slice(2)
+                    : token.startsWith("--request=")
+                        ? token.slice("--request=".length)
+                        : undefined;
+            if (requestMethod &&
+                !["GET", "HEAD", "OPTIONS"].includes(requestMethod.toUpperCase())) {
+                return true;
+            }
+            if (token === "-d" ||
+                token === "-F" ||
+                token === "--data" ||
+                token === "--data-raw" ||
+                token === "--form" ||
+                token === "--post-data" ||
+                token.startsWith("--data=") ||
+                token.startsWith("--data-raw=") ||
+                token.startsWith("--form=") ||
+                token.startsWith("--post-data=")) {
+                return true;
+            }
+        }
+    }
+    if (INTERPRETER_EVAL_COMMANDS.has(rootCommand)) {
+        if (tokens.some((token) => token === "-c" || token === "-e" || token.startsWith("-e"))) {
+            return true;
+        }
+        const moduleIndex = tokens.indexOf("-m");
+        const moduleName = moduleIndex >= 0 ? tokens[moduleIndex + 1] : undefined;
+        if (moduleName === "pip" || moduleName === "pip3") {
+            return isBlockedCommandSegment(tokens.slice(moduleIndex + 1));
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=command-policy-options.js.map

package/dist/safety/command-policy-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-policy-options.js","sourceRoot":"","sources":["../../src/safety/command-policy-options.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AAItC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,SAAS;IACT,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAC;IAClD,OAAO;IACP,mBAAmB;IACnB,kBAAkB;IAClB,SAAS;IACT,aAAa;IACb,YAAY;IACZ,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,UAAU,gCAAgC,CAAC,MAAgB;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,mCAAmC,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,CACL,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC1B,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;YAC5B,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAC7B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,MAAgB;IAC7D,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAE1D,IACE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAC/D,WAAW,CACZ,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CACjB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAgB,EAChB,uBAAuC;IAEvC,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAE1D,IAAI,gCAAgC,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACnD,OAAO,WAAW,CAChB,MAAM,EACN,IAAI,GAAG,CAAC;YACN,IAAI;YACJ,SAAS;YACT,OAAO;YACP,UAAU;YACV,KAAK;YACL,QAAQ;YACR,IAAI;YACJ,QAAQ;YACR,cAAc;SACf,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IACE,CAAC,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,MAAM,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EACjE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,IACE,KAAK,KAAK,IAAI;gBACd,KAAK,KAAK,IAAI;gBACd,KAAK,KAAK,UAAU;gBACpB,KAAK,KAAK,eAAe;gBACzB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBACtB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBACtB,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,EAC7B,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,aAAa,GACjB,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,WAAW;gBACrC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;gBACf,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;oBACtB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;oBAChB,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;wBAC9B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;wBAClC,CAAC,CAAC,SAAS,CAAC;YACpB,IACE,aAAa;gBACb,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,EACjE,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IACE,KAAK,KAAK,IAAI;gBACd,KAAK,KAAK,IAAI;gBACd,KAAK,KAAK,QAAQ;gBAClB,KAAK,KAAK,YAAY;gBACtB,KAAK,KAAK,QAAQ;gBAClB,KAAK,KAAK,aAAa;gBACvB,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC3B,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;gBAC/B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC3B,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,EAChC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,yBAAyB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,IACE,MAAM,CAAC,IAAI,CACT,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CACtE,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAClD,OAAO,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/safety/command-policy-packages.d.ts

@@ -0,0 +1,4 @@
+export type SegmentBlocker = (tokens: string[]) => boolean;
+export declare function isBlockedPackageManagerInvocation(tokens: string[], isBlockedCommandSegment: SegmentBlocker): boolean;
+export declare function isBlockedSystemPackageManagerInvocation(tokens: string[]): boolean;
+//# sourceMappingURL=command-policy-packages.d.ts.map

package/dist/safety/command-policy-packages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-policy-packages.d.ts","sourceRoot":"","sources":["../../src/safety/command-policy-packages.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;AAiI3D,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,MAAM,EAAE,EAChB,uBAAuB,EAAE,cAAc,GACtC,OAAO,CAoCT;AAED,wBAAgB,uCAAuC,CACrD,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAST"}

package/dist/safety/command-policy-packages.js

@@ -0,0 +1,161 @@
+import { hasGenericWriteOrLongRunningFlag } from "./command-policy-options.js";
+import { normalizeCommandName } from "./command-policy-wrappers.js";
+const PACKAGE_MANAGER_ROOTS = new Set([
+    "bun",
+    "cargo",
+    "corepack",
+    "gem",
+    "just",
+    "make",
+    "npm",
+    "npx",
+    "pip",
+    "pip3",
+    "pnpm",
+    "task",
+    "yarn",
+]);
+const SYSTEM_PACKAGE_MANAGER_ROOTS = new Set([
+    "apt",
+    "apt-get",
+    "brew",
+    "dnf",
+    "yum",
+]);
+const MUTATING_PACKAGE_SUBCOMMANDS = new Set([
+    "add",
+    "audit",
+    "autoclean",
+    "autoremove",
+    "ci",
+    "clean",
+    "create",
+    "dedupe",
+    "deploy",
+    "dist-upgrade",
+    "dlx",
+    "doctor",
+    "fix",
+    "i",
+    "import",
+    "init",
+    "install",
+    "link",
+    "pack",
+    "patch",
+    "patch-commit",
+    "prune",
+    "publish",
+    "purge",
+    "rebuild",
+    "release",
+    "remove",
+    "rm",
+    "set",
+    "set-script",
+    "unlink",
+    "uninstall",
+    "up",
+    "update",
+    "upgrade",
+    "version",
+]);
+const PACKAGE_EXEC_SUBCOMMANDS = new Set(["exec"]);
+const PACKAGE_OPTION_VALUE_FLAGS = new Set([
+    "--config",
+    "--dir",
+    "--filter",
+    "--global-dir",
+    "--prefix",
+    "--project",
+    "--registry",
+    "--store-dir",
+    "--workspace",
+    "-C",
+    "-F",
+    "-w",
+]);
+function getPackageSubcommandIndex(tokens) {
+    for (let i = 1; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (token === "--")
+            return undefined;
+        if (PACKAGE_OPTION_VALUE_FLAGS.has(token)) {
+            i++;
+            continue;
+        }
+        if (token.startsWith("--config=") ||
+            token.startsWith("--dir=") ||
+            token.startsWith("--filter=") ||
+            token.startsWith("--global-dir=") ||
+            token.startsWith("--prefix=") ||
+            token.startsWith("--project=") ||
+            token.startsWith("--registry=") ||
+            token.startsWith("--store-dir=") ||
+            token.startsWith("--workspace=")) {
+            continue;
+        }
+        if (token.startsWith("-"))
+            continue;
+        return i;
+    }
+    return undefined;
+}
+function nextNonOptionToken(tokens, startIndex) {
+    for (let i = startIndex; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (token === "--")
+            continue;
+        if (token.startsWith("-"))
+            continue;
+        return token;
+    }
+    return undefined;
+}
+function isBlockedPackageScriptName(scriptName) {
+    const normalized = scriptName.toLowerCase();
+    return /(^|[:_-])(build|codegen|deploy|dev|fix|format|generate|install|preview|publish|release|serve|start|update|watch|write)([:_-]|$)/.test(normalized);
+}
+export function isBlockedPackageManagerInvocation(tokens, isBlockedCommandSegment) {
+    const rootCommand = normalizeCommandName(tokens[0] ?? "");
+    if (!PACKAGE_MANAGER_ROOTS.has(rootCommand))
+        return false;
+    if (rootCommand === "npx" || rootCommand === "corepack")
+        return true;
+    if (hasGenericWriteOrLongRunningFlag(tokens))
+        return true;
+    const subcommandIndex = getPackageSubcommandIndex(tokens);
+    if (subcommandIndex === undefined)
+        return false;
+    const subcommand = tokens[subcommandIndex];
+    const subcommandLower = subcommand.toLowerCase();
+    if (PACKAGE_EXEC_SUBCOMMANDS.has(subcommandLower)) {
+        const invoked = nextNonOptionToken(tokens, subcommandIndex + 1);
+        if (!invoked)
+            return false;
+        const invokedIndex = tokens.indexOf(invoked, subcommandIndex + 1);
+        return isBlockedCommandSegment(tokens.slice(invokedIndex));
+    }
+    if (subcommandLower === "run") {
+        const scriptName = nextNonOptionToken(tokens, subcommandIndex + 1);
+        return scriptName ? isBlockedPackageScriptName(scriptName) : false;
+    }
+    if (rootCommand === "pip" ||
+        rootCommand === "pip3" ||
+        rootCommand === "gem") {
+        return MUTATING_PACKAGE_SUBCOMMANDS.has(subcommandLower);
+    }
+    if (MUTATING_PACKAGE_SUBCOMMANDS.has(subcommandLower))
+        return true;
+    return isBlockedPackageScriptName(subcommandLower);
+}
+export function isBlockedSystemPackageManagerInvocation(tokens) {
+    const rootCommand = normalizeCommandName(tokens[0] ?? "");
+    if (!SYSTEM_PACKAGE_MANAGER_ROOTS.has(rootCommand))
+        return false;
+    const subcommandIndex = getPackageSubcommandIndex(tokens);
+    if (subcommandIndex === undefined)
+        return false;
+    return MUTATING_PACKAGE_SUBCOMMANDS.has(tokens[subcommandIndex].toLowerCase());
+}
+//# sourceMappingURL=command-policy-packages.js.map

package/dist/safety/command-policy-packages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-policy-packages.js","sourceRoot":"","sources":["../../src/safety/command-policy-packages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIpE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,KAAK;IACL,OAAO;IACP,UAAU;IACV,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,KAAK;IACL,SAAS;IACT,MAAM;IACN,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,KAAK;IACL,OAAO;IACP,WAAW;IACX,YAAY;IACZ,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,KAAK;IACL,QAAQ;IACR,KAAK;IACL,GAAG;IACH,QAAQ;IACR,MAAM;IACN,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,cAAc;IACd,OAAO;IACP,SAAS;IACT,OAAO;IACP,SAAS;IACT,SAAS;IACT,QAAQ;IACR,IAAI;IACJ,KAAK;IACL,YAAY;IACZ,QAAQ;IACR,WAAW;IACX,IAAI;IACJ,QAAQ;IACR,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEnD,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,OAAO;IACP,UAAU;IACV,cAAc;IACd,UAAU;IACV,WAAW;IACX,YAAY;IACZ,aAAa;IACb,aAAa;IACb,IAAI;IACJ,IAAI;IACJ,IAAI;CACL,CAAC,CAAC;AAEH,SAAS,yBAAyB,CAAC,MAAgB;IACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACrC,IAAI,0BAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IACE,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YAC7B,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC1B,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YAC7B,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC;YACjC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YAC7B,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;YAC9B,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;YAC/B,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;YAChC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,EAChC,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAgB,EAChB,UAAkB;IAElB,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CAAC,UAAkB;IACpD,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,iIAAiI,CAAC,IAAI,CAC3I,UAAU,CACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAgB,EAChB,uBAAuC;IAEvC,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1D,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,gCAAgC,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,MAAM,eAAe,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IAEjD,IAAI,wBAAwB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC;QAClE,OAAO,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC;QACnE,OAAO,UAAU,CAAC,CAAC,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,CAAC;IAED,IACE,WAAW,KAAK,KAAK;QACrB,WAAW,KAAK,MAAM;QACtB,WAAW,KAAK,KAAK,EACrB,CAAC;QACD,OAAO,4BAA4B,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,4BAA4B,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnE,OAAO,0BAA0B,CAAC,eAAe,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,MAAgB;IAEhB,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAEjE,MAAM,eAAe,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,4BAA4B,CAAC,GAAG,CACrC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CACtC,CAAC;AACJ,CAAC"}

package/dist/safety/command-policy-parser.d.ts

@@ -0,0 +1,11 @@
+export type ParseEntry = string | {
+    op?: string;
+    comment?: string;
+};
+export declare function parseCommand(command: string): ParseEntry[] | null;
+/** Detect $() and backtick command substitution outside single quotes. */
+export declare function hasCommandSubstitution(command: string): boolean;
+export declare function hasUnsafeConstructs(entries: ParseEntry[]): boolean;
+export declare function hasUnsafeRedirects(entries: ParseEntry[]): boolean;
+export declare function extractSegments(entries: ParseEntry[]): string[][];
+//# sourceMappingURL=command-policy-parser.d.ts.map

package/dist/safety/command-policy-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-policy-parser.d.ts","sourceRoot":"","sources":["../../src/safety/command-policy-parser.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAUpE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,IAAI,CAQjE;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAmC/D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CA0BlE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CA6BjE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,EAAE,CAmBjE"}